🚨 Runner-Guard Security Finding
Rule: RGS-008 — Secret Directly Interpolated in run Block
Severity: High
File: .github/workflows/ci.yml
Line: 776
Description
A ${{ secrets.* }} expression or ${{ github.token }} appears directly inside a run: block's shell script rather than being passed via the env: mapping.
When secrets are interpolated directly into run: blocks using ${{ }} expressions, they are literally pasted into the shell script as plain text before execution.
Impact
This creates multiple risks:
- The secret value becomes part of the shell script text, potentially visible in error messages, debug logs, or process listings
- If the secret value contains shell metacharacters (quotes, backticks, dollar signs, semicolons), it can break shell script syntax or cause unintended command execution
- The secret is exposed to shell history and
/proc filesystem
- Any expression injection vulnerability in the same
run: block gains direct access to the secret value
GitHub's log masking only redacts known secret values from output, but cannot prevent secrets from being captured via side channels when they are embedded in the script source.
Location
File: .github/workflows/ci.yml, around line 776 ("Clone github/gh-aw-marketplace repository" step)
Remediation
Move the secret from the script body into the env: mapping:
Before (insecure):
- name: Clone github/gh-aw-marketplace repository
run: |
git clone (xaccesstoken/redacted):${{ secrets.GH_TOKEN }}`@github`.com/...After (safe):
- name: Clone github/gh-aw-marketplace repository
env:
GH_TOKEN: ${{ secrets.GH_TOKEN }}
run: |
git clone (xaccesstoken/redacted):${GH_TOKEN}`@github`.com/...By using the env: block, the secret is passed as an environment variable and GitHub's log masking works correctly. Shell metacharacters in the value cannot break the script syntax.
Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/25118934458
Generated by Static Analysis Report · ● 433.2K · ◷
🚨 Runner-Guard Security Finding
Rule: RGS-008 — Secret Directly Interpolated in run Block
Severity: High
File:
.github/workflows/ci.ymlLine: 776
Description
A
${{ secrets.* }}expression or${{ github.token }}appears directly inside arun:block's shell script rather than being passed via theenv:mapping.When secrets are interpolated directly into
run:blocks using${{ }}expressions, they are literally pasted into the shell script as plain text before execution.Impact
This creates multiple risks:
/procfilesystemrun:block gains direct access to the secret valueGitHub's log masking only redacts known secret values from output, but cannot prevent secrets from being captured via side channels when they are embedded in the script source.
Location
File:
.github/workflows/ci.yml, around line 776 ("Clone github/gh-aw-marketplace repository" step)Remediation
Move the secret from the script body into the
env:mapping:Before (insecure):
After (safe):
By using the
env:block, the secret is passed as an environment variable and GitHub's log masking works correctly. Shell metacharacters in the value cannot break the script syntax.Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/25118934458